The Apache Linkis JDBC EngineConn module has a RCE Vulnerability

Vulnerability

Description In Apache Linkis versions up to and including 1.2.0, when used with the MySQL Connector/J, a deserialization vulnerability exists. The root cause is that parameters in the JDBC URL are not sufficiently blacklisted, allowing an attacker to inject malicious serialized data that gets deserialized by the MySQL Connector/J [2].

Exploitation

Prerequisites An attacker must have write access to a database and the ability to configure a JDBC EngineConn (EC) with a MySQL data source and malicious parameters. No additional authentication is required beyond the database write access [2].

Impact

Successful exploitation can lead to remote code execution (RCE). An attacker can execute arbitrary code on the server hosting Apache Linkis, potentially compromising the entire system [2].

Mitigation

The vulnerability is fixed in Apache Linkis version 1.3.0, where JDBC URL parameters are blacklisted to prevent deserialization attacks. Users are strongly recommended to upgrade to 1.3.0 or later [2].